RHSA-2026:74683

Vulnerability from csaf_redhat - Published: 2026-10-01 20:56 - Updated: 2026-10-02 02:17
Summary
Red Hat Security Advisory: Red Hat AI Base Images 3.4.3 (CUDA 13.0)
Severity
Important
Notes
Topic: Red Hat AI Base Images 3.4.3 (CUDA 13.0) is now available.
Details: Red Hat® AI Base Images
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-6170

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.

2.5 (Low)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-121 - Stack-based Buffer Overflow
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Low
CVE-2026-8643

A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution.

8.0 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-11822

A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-11824

A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-191 - Integer Underflow (Wrap or Wraparound)
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-11940

A flaw was found in the `tarfile.extractall()` function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.

7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-15308

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit (CPU) resources. This leads to a denial of service, making the affected system unresponsive.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-15588

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.

5.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-16118

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CWE-122 - Heap-based Buffer Overflow
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-47162

A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of unauthorized commands. This could lead to arbitrary code execution on the affected system.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-140 - Improper Neutralization of Delimiters
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-47167

A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition patterns. If a user opens this repository and triggers a specific function, the crafted patterns are unsafely processed, potentially allowing the attacker to execute unauthorized commands on the user's system.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-52858

A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a sibling Python package. This could lead to a complete compromise of the user's system.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-54369

A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-55693

A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by tricking a user into loading a specially crafted spell file. When the user invokes spell suggestion, the editor attempts to process the malicious file, leading to an out-of-bounds write that corrupts memory and causes the application to crash, resulting in a denial of service.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-57455

A memory corruption flaw in Vim allows an attacker to cause a Denial of Service (DoS). When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spell_soundfold_sofo() function, causing the editor to crash.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-57456

There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-58010

A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CWE-126 - Buffer Over-read
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-58011

A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CWE-125 - Out-of-bounds Read
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-58012

A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CWE-126 - Buffer Over-read
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-58013

A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CWE-126 - Buffer Over-read
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-58014

A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.

7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-193 - Off-by-one Error
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-58015

A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-59856

A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remote attacker to achieve arbitrary operating-system command execution.

5.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-59858

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature.

6.5 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Moderate
CVE-2026-60002

A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability.

7.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-64830

A flaw was found in FFmpeg, a widely used multimedia framework. This vulnerability, a heap buffer overflow in the VobSub subtitle demuxer, allows a remote attacker to corrupt memory. By providing a specially crafted subtitle file, an attacker can trigger unbounded writes, which could lead to arbitrary code execution in applications that use FFmpeg's VobSub demuxer. This could allow an attacker to take control of the affected system.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-73066

A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract's deserializer processes this component during OCR recognition, an unchecked integer multiplication can occur, leading to an undersized buffer and a heap out-of-bounds write. This vulnerability could result in a denial of service or potentially arbitrary code execution.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-73072

A heap buffer overflow in Vim allows a local attacker to cause a denial of service or potentially execute arbitrary code. The flaw is triggered by processing a specially crafted spell file, where the set_sofo() function fails to reset internal data between sections, leading to an out-of-bounds write.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-73076

A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimball#RmVimball() function.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-73077

A vulnerability in Vim's shell script plugins (sh.vim, zsh.vim, ps1.vim) allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
CVE-2026-73078

A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products
Fixed 2 products, the same list as for CVE-2025-6170
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:74683 self
https://access.redhat.com/security/cve/CVE-2025-6170 external
https://access.redhat.com/security/cve/CVE-2026-11822 external
https://access.redhat.com/security/cve/CVE-2026-11824 external
https://access.redhat.com/security/cve/CVE-2026-11940 external
https://access.redhat.com/security/cve/CVE-2026-15308 external
https://access.redhat.com/security/cve/CVE-2026-15588 external
https://access.redhat.com/security/cve/CVE-2026-16118 external
https://access.redhat.com/security/cve/CVE-2026-47162 external
https://access.redhat.com/security/cve/CVE-2026-47167 external
https://access.redhat.com/security/cve/CVE-2026-52858 external
https://access.redhat.com/security/cve/CVE-2026-54369 external
https://access.redhat.com/security/cve/CVE-2026-55693 external
https://access.redhat.com/security/cve/CVE-2026-57455 external
https://access.redhat.com/security/cve/CVE-2026-57456 external
https://access.redhat.com/security/cve/CVE-2026-58010 external
https://access.redhat.com/security/cve/CVE-2026-58011 external
https://access.redhat.com/security/cve/CVE-2026-58012 external
https://access.redhat.com/security/cve/CVE-2026-58013 external
https://access.redhat.com/security/cve/CVE-2026-58014 external
https://access.redhat.com/security/cve/CVE-2026-58015 external
https://access.redhat.com/security/cve/CVE-2026-59856 external
https://access.redhat.com/security/cve/CVE-2026-59858 external
https://access.redhat.com/security/cve/CVE-2026-60002 external
https://access.redhat.com/security/cve/CVE-2026-64830 external
https://access.redhat.com/security/cve/CVE-2026-73066 external
https://access.redhat.com/security/cve/CVE-2026-73072 external
https://access.redhat.com/security/cve/CVE-2026-73076 external
https://access.redhat.com/security/cve/CVE-2026-73077 external
https://access.redhat.com/security/cve/CVE-2026-73078 external
https://access.redhat.com/security/cve/CVE-2026-8643 external
https://access.redhat.com/security/updates/classi… external
https://www.redhat.com/en/products/ai external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2025-6170 self
https://bugzilla.redhat.com/show_bug.cgi?id=2372952 external
https://www.cve.org/CVERecord?id=CVE-2025-6170 external
https://nvd.nist.gov/vuln/detail/CVE-2025-6170 external
https://gitlab.gnome.org/GNOME/libxml2/-/issues/941 external
https://access.redhat.com/security/cve/CVE-2026-8643 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460927 external
https://www.cve.org/CVERecord?id=CVE-2026-8643 external
https://nvd.nist.gov/vuln/detail/CVE-2026-8643 external
https://github.com/pypa/pip/commit/8eb178480bd1a2… external
https://access.redhat.com/security/cve/CVE-2026-11822 self
https://bugzilla.redhat.com/show_bug.cgi?id=2487258 external
https://www.cve.org/CVERecord?id=CVE-2026-11822 external
https://nvd.nist.gov/vuln/detail/CVE-2026-11822 external
https://sqlite.org/releaselog/3_53_2.html external
https://sqlite.org/src/info/061febcf41ca external
https://sqlite.org/src/info/4a5ad516ea93 external
https://www.vulncheck.com/advisories/sqlite-befor… external
https://access.redhat.com/security/cve/CVE-2026-11824 self
https://bugzilla.redhat.com/show_bug.cgi?id=2487269 external
https://www.cve.org/CVERecord?id=CVE-2026-11824 external
https://nvd.nist.gov/vuln/detail/CVE-2026-11824 external
https://www.vulncheck.com/advisories/sqlite-befor… external
https://access.redhat.com/security/cve/CVE-2026-11940 self
https://bugzilla.redhat.com/show_bug.cgi?id=2491848 external
https://www.cve.org/CVERecord?id=CVE-2026-11940 external
https://nvd.nist.gov/vuln/detail/CVE-2026-11940 external
https://github.com/python/cpython/issues/151558 external
https://github.com/python/cpython/pull/151559 external
https://mail.python.org/archives/list/security-an… external
https://access.redhat.com/security/cve/CVE-2026-15308 self
https://bugzilla.redhat.com/show_bug.cgi?id=2498608 external
https://www.cve.org/CVERecord?id=CVE-2026-15308 external
https://nvd.nist.gov/vuln/detail/CVE-2026-15308 external
https://github.com/python/cpython/commit/07efb081… external
https://github.com/python/cpython/commit/7933f4bf… external
https://github.com/python/cpython/commit/bcf98ddb… external
https://github.com/python/cpython/commit/e9f92ac0… external
https://github.com/python/cpython/issues/153030 external
https://github.com/python/cpython/pull/153031 external
https://mail.python.org/archives/list/security-an… external
https://access.redhat.com/security/cve/CVE-2026-15588 self
https://bugzilla.redhat.com/show_bug.cgi?id=2499675 external
https://www.cve.org/CVERecord?id=CVE-2026-15588 external
https://nvd.nist.gov/vuln/detail/CVE-2026-15588 external
https://gitlab.gnome.org/GNOME/glib/-/issues/3985 external
https://access.redhat.com/security/cve/CVE-2026-16118 self
https://bugzilla.redhat.com/show_bug.cgi?id=2501732 external
https://www.cve.org/CVERecord?id=CVE-2026-16118 external
https://nvd.nist.gov/vuln/detail/CVE-2026-16118 external
https://gitlab.freedesktop.org/xdg/xdgmime/-/work… external
https://access.redhat.com/security/cve/CVE-2026-47162 self
https://bugzilla.redhat.com/show_bug.cgi?id=2487964 external
https://www.cve.org/CVERecord?id=CVE-2026-47162 external
https://nvd.nist.gov/vuln/detail/CVE-2026-47162 external
https://github.com/vim/vim/commit/f08ab2f4d7d2947… external
https://github.com/vim/vim/releases/tag/v9.2.0495 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-47167 self
https://bugzilla.redhat.com/show_bug.cgi?id=2487996 external
https://www.cve.org/CVERecord?id=CVE-2026-47167 external
https://nvd.nist.gov/vuln/detail/CVE-2026-47167 external
https://github.com/vim/vim/commit/a65a52d684bc585… external
https://github.com/vim/vim/releases/tag/v9.2.0496 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-52858 self
https://bugzilla.redhat.com/show_bug.cgi?id=2487981 external
https://www.cve.org/CVERecord?id=CVE-2026-52858 external
https://nvd.nist.gov/vuln/detail/CVE-2026-52858 external
https://github.com/vim/vim/commit/4b850457e12e1a6… external
https://github.com/vim/vim/releases/tag/v9.2.0561 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-54369 self
https://bugzilla.redhat.com/show_bug.cgi?id=2490277 external
https://www.cve.org/CVERecord?id=CVE-2026-54369 external
https://nvd.nist.gov/vuln/detail/CVE-2026-54369 external
https://access.redhat.com/security/cve/CVE-2026-55693 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492980 external
https://www.cve.org/CVERecord?id=CVE-2026-55693 external
https://nvd.nist.gov/vuln/detail/CVE-2026-55693 external
https://github.com/vim/vim/commit/a80874d9b84a010… external
https://github.com/vim/vim/releases/tag/v9.2.0653 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-57455 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492968 external
https://www.cve.org/CVERecord?id=CVE-2026-57455 external
https://nvd.nist.gov/vuln/detail/CVE-2026-57455 external
https://github.com/vim/vim/commit/497f931f85339d1… external
https://github.com/vim/vim/releases/tag/v9.2.0698 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-57456 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492972 external
https://www.cve.org/CVERecord?id=CVE-2026-57456 external
https://nvd.nist.gov/vuln/detail/CVE-2026-57456 external
https://github.com/vim/vim/commit/cce141c42740f12… external
https://github.com/vim/vim/releases/tag/v9.2.0699 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-58010 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492243 external
https://www.cve.org/CVERecord?id=CVE-2026-58010 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58010 external
https://gitlab.gnome.org/GNOME/glib/-/issues/3915 external
https://access.redhat.com/security/cve/CVE-2026-58011 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492245 external
https://www.cve.org/CVERecord?id=CVE-2026-58011 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58011 external
https://gitlab.gnome.org/GNOME/glib/-/issues/3917 external
https://access.redhat.com/security/cve/CVE-2026-58012 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492247 external
https://www.cve.org/CVERecord?id=CVE-2026-58012 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58012 external
https://gitlab.gnome.org/GNOME/glib/-/issues/3918 external
https://access.redhat.com/security/cve/CVE-2026-58013 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492248 external
https://www.cve.org/CVERecord?id=CVE-2026-58013 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58013 external
https://gitlab.gnome.org/GNOME/glib/-/issues/3925 external
https://access.redhat.com/security/cve/CVE-2026-58014 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492255 external
https://www.cve.org/CVERecord?id=CVE-2026-58014 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58014 external
https://gitlab.gnome.org/GNOME/glib/-/issues/3930 external
https://access.redhat.com/security/cve/CVE-2026-58015 self
https://bugzilla.redhat.com/show_bug.cgi?id=2492256 external
https://www.cve.org/CVERecord?id=CVE-2026-58015 external
https://nvd.nist.gov/vuln/detail/CVE-2026-58015 external
https://gitlab.gnome.org/GNOME/glib/-/issues/3931 external
https://access.redhat.com/security/cve/CVE-2026-59856 self
https://bugzilla.redhat.com/show_bug.cgi?id=2498867 external
https://www.cve.org/CVERecord?id=CVE-2026-59856 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59856 external
https://github.com/vim/vim/commit/43afc581a37a357… external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-59858 self
https://bugzilla.redhat.com/show_bug.cgi?id=2498868 external
https://www.cve.org/CVERecord?id=CVE-2026-59858 external
https://nvd.nist.gov/vuln/detail/CVE-2026-59858 external
https://github.com/vim/vim/commit/6b611b0d15603c5… external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-60002 self
https://bugzilla.redhat.com/show_bug.cgi?id=2497936 external
https://www.cve.org/CVERecord?id=CVE-2026-60002 external
https://nvd.nist.gov/vuln/detail/CVE-2026-60002 external
https://marc.info/?l=openssh-unix-dev&m=178333966… external
https://www.openssh.org/releasenotes.html#10.4p1 external
https://www.openwall.com/lists/oss-security/2026/… external
https://access.redhat.com/security/cve/CVE-2026-64830 self
https://bugzilla.redhat.com/show_bug.cgi?id=2506193 external
https://www.cve.org/CVERecord?id=CVE-2026-64830 external
https://nvd.nist.gov/vuln/detail/CVE-2026-64830 external
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd4… external
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657 external
https://www.vulncheck.com/advisories/ffmpeg-heap-… external
https://access.redhat.com/security/cve/CVE-2026-73066 self
https://bugzilla.redhat.com/show_bug.cgi?id=2514011 external
https://www.cve.org/CVERecord?id=CVE-2026-73066 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73066 external
https://github.com/tesseract-ocr/tesseract/commit… external
https://github.com/tesseract-ocr/tesseract/pull/4588 external
https://github.com/tesseract-ocr/tesseract/releas… external
https://github.com/tesseract-ocr/tesseract/securi… external
https://access.redhat.com/security/cve/CVE-2026-73072 self
https://bugzilla.redhat.com/show_bug.cgi?id=2514037 external
https://www.cve.org/CVERecord?id=CVE-2026-73072 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73072 external
https://github.com/vim/vim/commit/05c41c922309c7a… external
https://github.com/vim/vim/releases/tag/v9.2.0846 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-73076 self
https://bugzilla.redhat.com/show_bug.cgi?id=2514034 external
https://www.cve.org/CVERecord?id=CVE-2026-73076 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73076 external
https://github.com/vim/vim/commit/581a2f3ac9c6f96… external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-73077 self
https://bugzilla.redhat.com/show_bug.cgi?id=2514065 external
https://www.cve.org/CVERecord?id=CVE-2026-73077 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73077 external
https://github.com/vim/vim/commit/c5a82fe013e73c9… external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-73078 self
https://bugzilla.redhat.com/show_bug.cgi?id=2514058 external
https://www.cve.org/CVERecord?id=CVE-2026-73078 external
https://nvd.nist.gov/vuln/detail/CVE-2026-73078 external
https://github.com/vim/vim/commit/29c6fd090d45205… external
https://github.com/vim/vim/security/advisories/GH… external
Acknowledgments
Ahmed Lekssays
Gitee Codepecker Lab
asotyc
Andrew Tridgell <tridge60@gmail.com> Alexander Peslyak <solar@openwall.com>
linhlhq
Thepwnisher
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AI Base Images 3.4.3 (CUDA 13.0) is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat\u00ae AI Base Images",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:74683",
        "url": "https://access.redhat.com/errata/RHSA-2026:74683"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-6170",
        "url": "https://access.redhat.com/security/cve/CVE-2025-6170"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-11822",
        "url": "https://access.redhat.com/security/cve/CVE-2026-11822"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-11824",
        "url": "https://access.redhat.com/security/cve/CVE-2026-11824"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-11940",
        "url": "https://access.redhat.com/security/cve/CVE-2026-11940"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-15308",
        "url": "https://access.redhat.com/security/cve/CVE-2026-15308"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-15588",
        "url": "https://access.redhat.com/security/cve/CVE-2026-15588"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-16118",
        "url": "https://access.redhat.com/security/cve/CVE-2026-16118"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-47162",
        "url": "https://access.redhat.com/security/cve/CVE-2026-47162"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-47167",
        "url": "https://access.redhat.com/security/cve/CVE-2026-47167"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-52858",
        "url": "https://access.redhat.com/security/cve/CVE-2026-52858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54369",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54369"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55693",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55693"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57455",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57455"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57456",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57456"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58010",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58010"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58011",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58011"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58012",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58012"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58013",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58013"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58014",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58014"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58015",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58015"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59856",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59856"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59858",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-60002",
        "url": "https://access.redhat.com/security/cve/CVE-2026-60002"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-64830",
        "url": "https://access.redhat.com/security/cve/CVE-2026-64830"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73066",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73066"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73072",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73072"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73076",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73076"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73077",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73077"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73078",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73078"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-8643",
        "url": "https://access.redhat.com/security/cve/CVE-2026-8643"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://www.redhat.com/en/products/ai",
        "url": "https://www.redhat.com/en/products/ai"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74683.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AI Base Images 3.4.3 (CUDA 13.0)",
    "tracking": {
      "current_release_date": "2026-10-02T02:17:09+00:00",
      "generator": {
        "date": "2026-10-02T02:17:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:74683",
      "initial_release_date": "2026-10-01T20:56:09+00:00",
      "revision_history": [
        {
          "date": "2026-10-01T20:56:09+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-01T20:56:12+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-02T02:17:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift AI 3.4",
                "product": {
                  "name": "Red Hat OpenShift AI 3.4",
                  "product_id": "Red Hat OpenShift AI 3.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_ai:3.4::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift AI"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
                "product": {
                  "name": "registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
                  "product_id": "registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/base-image-cuda-13.0-rhel9@sha256%3A5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3?arch=amd64\u0026repository_url=registry.redhat.io/rhai/base-image-cuda-13.0-rhel9\u0026tag=1790703641"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64",
                "product": {
                  "name": "registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64",
                  "product_id": "registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/base-image-cuda-13.0-rhel9@sha256%3Adfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4?arch=arm64\u0026repository_url=registry.redhat.io/rhai/base-image-cuda-13.0-rhel9\u0026tag=1790703641"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64 as a component of Red Hat OpenShift AI 3.4",
          "product_id": "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64"
        },
        "product_reference": "registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
        "relates_to_product_reference": "Red Hat OpenShift AI 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64 as a component of Red Hat OpenShift AI 3.4",
          "product_id": "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        },
        "product_reference": "registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64",
        "relates_to_product_reference": "Red Hat OpenShift AI 3.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Ahmed Lekssays"
          ]
        }
      ],
      "cve": "CVE-2025-6170",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "discovery_date": "2025-06-16T05:33:22.955000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2372952"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team has rated the severity of this vulnerability as Low, since it affects only the interactive shell mode of the xmllint tool and requires a user to manually run the tool and enter or receive specially crafted input. The exploitation requires local access and a highly specific usage scenario that is uncommon in typical environments. While it can cause a crash, the impact is limited to availability, and exploitation is unlikely in real-world deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-6170"
        },
        {
          "category": "external",
          "summary": "RHBZ#2372952",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372952"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-6170",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-6170"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941",
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941"
        }
      ],
      "release_date": "2025-06-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to a widespread installation base, or stability. It is strongly recommended to apply the upstream patch once available.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling"
    },
    {
      "acknowledgments": [
        {
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-8643",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-04-22T23:09:35+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460927"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in pip\u0027s wheel installation process allows for arbitrary file overwrite due to path traversal. An attacker could exploit this by convincing a user to install a specially crafted malicious Python wheel. While file overwrites are limited to the installing user\u0027s permissions, using `pip install` with elevated privileges in Red Hat environments significantly increases the potential impact, potentially leading to system integrity compromise or arbitrary code execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8643"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460927",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460927"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8643",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8643"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8643",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8643"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb",
          "url": "https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb"
        }
      ],
      "release_date": "2026-05-27T17:03:36.585000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid installing Python wheels from untrusted sources. It is strongly advised against using `pip install` with elevated privileges, such as `sudo`, when installing wheels. Additionally, administrators should inspect `entry_points.txt` within wheels for path separators or absolute paths before installation.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite"
    },
    {
      "cve": "CVE-2026-11822",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-06-09T20:01:15.006955+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487258"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in SQLite\u0027s FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the SQLite FTS5 full-text search extension can lead to arbitrary code execution or denial of service. Exploitation requires an application to process a specially crafted SQLite database containing malformed FTS5 page data, which could occur if an attacker provides a malicious database to a vulnerable application. This risk is elevated in scenarios where applications handle untrusted SQLite database files.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11822"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487258",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487258"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11822",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11822"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/releaselog/3_53_2.html",
          "url": "https://sqlite.org/releaselog/3_53_2.html"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/061febcf41ca",
          "url": "https://sqlite.org/src/info/061febcf41ca"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/4a5ad516ea93",
          "url": "https://sqlite.org/src/info/4a5ad516ea93"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension",
          "url": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension"
        }
      ],
      "release_date": "2026-06-09T19:08:31.019000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data"
    },
    {
      "cve": "CVE-2026-11824",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "discovery_date": "2026-06-09T20:02:19.874232+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487269"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in SQLite\u0027s FTS5 full-text search extension can lead to arbitrary code execution or application crashes due to a heap-based buffer overflow. Exploitation requires an attacker to provide a specially crafted SQLite database, which must then be processed by an application compiled with FTS5 support. While requiring user interaction and local access, the potential for full impact on system resources justifies the Important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11824"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487269",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487269"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11824",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11824"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/releaselog/3_53_2.html",
          "url": "https://sqlite.org/releaselog/3_53_2.html"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/061febcf41ca",
          "url": "https://sqlite.org/src/info/061febcf41ca"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/4a5ad516ea93",
          "url": "https://sqlite.org/src/info/4a5ad516ea93"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate",
          "url": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate"
        }
      ],
      "release_date": "2026-06-09T19:21:42.603000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5"
    },
    {
      "cve": "CVE-2026-11940",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-06-23T17:05:33.822236+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491848"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `tarfile.extractall()` function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat products that appear in dependency searches under names containing \"tarfile\" but that are not the CPython standard-library tarfile module are not affected by this flaw. Matches such as the Go packages under github.com/containers/image / go.podman.io/image (.../docker/tarfile and .../docker/internal/tarfile) and the Apache Camel artifacts (camel-tarfile, camel-quarkus-tarfile) are unrelated implementations in other languages and do not include the vulnerable CPython tarfile.extractall() filter logic. The separately packaged PyPI component backports-tarfile is also out of scope for this CVE as assigned: it is not the CPython stdlib module named in the advisory and this CVE tracks the interpreter-provided tarfile shipped in Red Hat python3* packages.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11940"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491848",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491848"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11940",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11940"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11940",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11940"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/151558",
          "url": "https://github.com/python/cpython/issues/151558"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/151559",
          "url": "https://github.com/python/cpython/pull/151559"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"
        }
      ],
      "release_date": "2026-06-23T16:04:17.321000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory"
    },
    {
      "cve": "CVE-2026-15308",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-09T18:02:10.090070+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498608"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit (CPU) resources. This leads to a denial of service, making the affected system unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Python\u0027s `html.parser.HTMLParser` can lead to a denial of service. By supplying specially crafted, malformed HTML with repeated unterminated markup declarations, an attacker can cause excessive CPU consumption, rendering the system unresponsive. Red Hat products utilizing this parser to process untrusted HTML content are susceptible to resource exhaustion.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15308"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498608",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498608"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15308",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15308"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15308",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15308"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9",
          "url": "https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced",
          "url": "https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606",
          "url": "https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd",
          "url": "https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/153030",
          "url": "https://github.com/python/cpython/issues/153030"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/153031",
          "url": "https://github.com/python/cpython/pull/153031"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/"
        }
      ],
      "release_date": "2026-07-09T17:10:57.317000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Gitee Codepecker Lab"
          ]
        }
      ],
      "cve": "CVE-2026-15588",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499675"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the `GDBus` component of GLib. A local or remote unauthenticated attacker could send an engineered stream of data without line length limitations during the authentication process (`gdbusauth`), leading to excessive memory allocation and CPU consumption. This resource exhaustion can result in a denial-of-service (DoS) condition, causing applications or services dependent on GLib to become unstable or crash.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15588"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499675",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499675"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15588",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15588"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15588",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15588"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3985",
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3985"
        }
      ],
      "release_date": "2026-07-12T10:10:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "asotyc"
          ]
        }
      ],
      "cve": "CVE-2026-16118",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "discovery_date": "2026-07-17T13:20:23.862000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2501732"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker must convince a user to install a malicious MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) and process it with an application performing MIME type detection, limiting its exposure. Also, only little-endian systems are vulnerable. Due to these reasons, this issue has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16118"
        },
        {
          "category": "external",
          "summary": "RHBZ#2501732",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501732"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16118",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16118"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16118",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16118"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41",
          "url": "https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41"
        }
      ],
      "release_date": "2026-07-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "Do not install a MIME magic file or content from untrusted sources.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c"
    },
    {
      "cve": "CVE-2026-47162",
      "cwe": {
        "id": "CWE-140",
        "name": "Improper Neutralization of Delimiters"
      },
      "discovery_date": "2026-06-11T19:00:56.050612+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487964"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of unauthorized commands. This could lead to arbitrary code execution on the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary Code Execution via crafted directory names",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-47162"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487964",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487964"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-47162",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-47162"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47162",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47162"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b",
          "url": "https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0495",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0495"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c"
        }
      ],
      "release_date": "2026-06-11T18:32:14.471000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary Code Execution via crafted directory names"
    },
    {
      "cve": "CVE-2026-47167",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-06-11T19:02:45.999423+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487996"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition patterns. If a user opens this repository and triggers a specific function, the crafted patterns are unsafely processed, potentially allowing the attacker to execute unauthorized commands on the user\u0027s system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via crafted step-definition patterns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Vim\u0027s cucumber filetype plugin, when configured with Ruby support, allows for arbitrary code execution. An attacker could exploit this by convincing a user to open a specially crafted repository and trigger a specific step-jump mapping, leading to local command execution. This risk is contingent on user interaction with untrusted content and the presence of the Ruby-enabled cucumber plugin.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-47167"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487996",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487996"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-47167",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-47167"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47167",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47167"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934",
          "url": "https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0496",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0496"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9"
        }
      ],
      "release_date": "2026-06-11T18:31:44.286000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should exercise caution when opening untrusted files or repositories with Vim, particularly those that might trigger the `cucumber` filetype plugin. Avoiding interaction with untrusted content can prevent the execution of malicious step-definition patterns.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via crafted step-definition patterns"
    },
    {
      "cve": "CVE-2026-52858",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-06-11T19:01:57.042099+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487981"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a sibling Python package. This could lead to a complete compromise of the user\u0027s system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via Python omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability in Vim that allows a local attacker to achieve arbitrary code execution. The flaw occurs when a user opens a specially crafted Python file and invokes omni-completion, leading to the execution of malicious code from a co-located Python package. This risk is present in Red Hat Enterprise Linux and other products where Vim is deployed with Python omni-completion enabled, potentially compromising the editing user\u0027s system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-52858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487981",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487981"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-52858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-52858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-52858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52858"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d",
          "url": "https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0561",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0561"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c"
        }
      ],
      "release_date": "2026-06-11T18:32:32.722000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "Users can mitigate this vulnerability by disabling Python omni-completion in Vim if it is not essential for their workflow. This prevents the execution of untrusted Python code when opening hostile files. To disable this feature, ensure that the `omnifunc` option in your Vim configuration (e.g., `~/.vimrc`) is not set to `pythoncomplete#Complete` or `python3complete#Complete`. Alternatively, users should avoid invoking omni-completion (`Ctrl-X Ctrl-O`) on Python files from untrusted sources. Disabling Python omni-completion may affect Python development functionality within Vim.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via Python omni-completion"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Andrew Tridgell \u003ctridge60@gmail.com\u003e",
            "Alexander Peslyak \u003csolar@openwall.com\u003e"
          ]
        }
      ],
      "cve": "CVE-2026-54369",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2026-06-16T23:47:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490277"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acl: Symlink traversal privilege escalation via libacl functions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this flaw as Important because a local attacker who controls any component of a pathname processed by a privileged process using libacl can redirect ACL operations to arbitrary files. Exploitation requires local access with the ability to create symlinks in a directory that a privileged program later processes with acl_get_file() or acl_set_file(). In default RHEL and OpenShift CoreOS configurations, standard file permission settings limit where unprivileged users can create symlinks, reducing the practical attack surface. Programs that operate on user-supplied paths with elevated privileges are most at risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54369"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490277",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54369",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54369"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369"
        }
      ],
      "release_date": "2026-06-29T13:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "Restrict unprivileged users from creating symlinks in directories that privileged processes operate on with ACL commands. Where possible, use the fs.protected_symlinks sysctl (enabled by default on RHEL 7+), which prevents symlink following in world-writable sticky directories unless the owner of the symlink matches the owner of the target file or directory.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "acl: Symlink traversal privilege escalation via libacl functions"
    },
    {
      "cve": "CVE-2026-55693",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-06-25T16:02:21.870241+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492980"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by tricking a user into loading a specially crafted spell file. When the user invokes spell suggestion, the editor attempts to process the malicious file, leading to an out-of-bounds write that corrupts memory and causes the application to crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Out-of-bounds Write in Spell File Word Count",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact vulnerability in Vim\u0027s spell suggestion feature allows an attacker to cause a denial of service. By tricking a user into loading a specially crafted spell file and invoking spell suggestion, an out-of-bounds write can occur, leading to a crash of the editor. This requires user interaction and a malicious file, limiting its immediate exploitability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492980",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492980"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55693",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55693",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7",
          "url": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0653",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0653"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq"
        }
      ],
      "release_date": "2026-06-25T15:34:33.424000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Out-of-bounds Write in Spell File Word Count"
    },
    {
      "cve": "CVE-2026-57455",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-06-25T16:01:18.343208+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492968"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory corruption flaw in Vim allows an attacker to cause a Denial of Service (DoS). When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spell_soundfold_sofo() function, causing the editor to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in Vim, a command-line text editor, is due to a stack out-of-bounds write in the spell checker. Exploitation requires a user to open a specially crafted file or encounter a long word via spell suggestion while a SOFO-based spell language is active, leading to a Denial of Service. This is not a default configuration in most Red Hat environments, limiting the attack surface.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492968",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492968"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57455",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57455",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b",
          "url": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0698",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0698"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4"
        }
      ],
      "release_date": "2026-06-25T15:22:37.949000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue disable spell checking or avoid using SOFO-based spell files. This can be achieved globally by adding set nospell to your ~/.vimrc configuration file. Ensure your systems utilize standard UTF-8 encoding. This flaw is strictly confined to legacy 8-bit encodings and cannot be triggered under default Red Hat configurations.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()"
    },
    {
      "cve": "CVE-2026-57456",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-06-25T16:01:37.648886+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492972"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated as Important. A vulnerability in Vim\u0027s Python omni-completion feature allows for arbitrary code execution. By opening a specially crafted file, a local attacker could execute arbitrary Python code due to improper handling of docstrings during omni-completion, leading to a compromise of the system where Vim is running.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492972",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492972"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57456",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57456",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8",
          "url": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0699",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0699"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3"
        }
      ],
      "release_date": "2026-06-25T15:16:16.015000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, users should avoid opening untrusted Python files or using Python omni-completion on such files. If Python omni-completion is not required, it can be disabled by adding `autocmd FileType python setlocal omnifunc=` to your `.vimrc` file. This will prevent the vulnerable code from being executed. Disabling Python omni-completion will remove the ability to use `Ctrl-X Ctrl-O` for Python code completion. A restart of Vim is required for the changes to take effect.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "linhlhq"
          ]
        }
      ],
      "cve": "CVE-2026-58010",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "discovery_date": "2026-06-24T16:21:49.589000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492243"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses \u003e instead of \u003e=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Any applications calling the `g_variant_is_normal_form()`,\u00a0`g_variant_get_normal_form()` or\u00a0`g_variant_byteswap()` functions that process untrusted GVariant data received from D-Bus, network or file are vulnerable to this issue. This flaw can cause an out-of-bounds read of only 1 byte, leading to an information disclosure of only 1 byte and a denial of service when the out-of-bounds read crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58010"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492243",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492243"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58010",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58010"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58010",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58010"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3915",
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3915"
        }
      ],
      "release_date": "2026-03-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "linhlhq"
          ]
        }
      ],
      "cve": "CVE-2026-58011",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-06-24T16:30:03.305000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492245"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Any applications that allow a user to submit a date to `g_date_time_add_full()` and later call any getter functions, such as `g_date_time_get_month()` or `g_date_time_get_year()`, with the returned GDateTime object are vulnerable to this issue. This flaw can cause an out-of-bounds read of only 2 bytes, leading to a denial of service due to logic errors that a corrupted date can trigger. Due to these reasons, this vulnerability has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58011"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492245",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492245"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58011",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58011"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58011",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58011"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3917",
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3917"
        }
      ],
      "release_date": "2026-03-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, in applications processing user-supplied dates, implement input validation to ensure the supplied date is within the supported range before calling g_date_time_add_full() with untrusted data, specifically rejecting inputs that result in a negative or zero days field.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "linhlhq"
          ]
        }
      ],
      "cve": "CVE-2026-58012",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "discovery_date": "2026-06-24T16:40:58.048000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492247"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Any applications that use g_regex_replace() or g_regex_replace_eval() with the G_REGEX_RAW compile flag and allow user-controlled replacement strings containing case-change escapes (\\u,\u00a0\\l,\u00a0\\U,\u00a0\\L) are vulnerable to this issue. This flaw can cause a buffer over-read of 1-5 bytes, leading to a minor information disclosure and a denial of service when the buffer over-read crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58012"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492247",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492247"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58012",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58012"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58012",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58012"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3918",
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3918"
        }
      ],
      "release_date": "2026-03-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, implement strict input validation to sanitize user-supplied replacement strings, specifically rejecting or escaping case-change modifiers (\\u, \\l, \\U, \\L) before calling g_regex_replace() or g_regex_replace_eval() when the G_REGEX_RAW compile flag is used. Removing the G_REGEX_RAW flag or hardcoding the replacement strings will completely neutralize this issue.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "linhlhq"
          ]
        }
      ],
      "cve": "CVE-2026-58013",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "discovery_date": "2026-06-24T16:49:18.947000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492248"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "glib: buffer over-read in glib/giochannel.c via \"g_io_channel_read_line_backend\"",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Any applications calling g_io_channel_set_line_term() with a multi-byte line terminator (length greater than one) and subsequently calling g_io_channel_read_line_backend() are vulnerable to this issue. This flaw can cause a buffer over-read of 8 bytes, leading to an information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58013"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492248",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492248"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58013",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58013"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58013",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58013"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3925",
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3925"
        }
      ],
      "release_date": "2026-04-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, restrict any custom line terminator string passed to g_io_channel_set_line_term() to a maximum length of one byte before calling g_io_channel_read_line_backend(). Using the default line terminators will completely neutralize this issue.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "glib: buffer over-read in glib/giochannel.c via \"g_io_channel_read_line_backend\""
    },
    {
      "acknowledgments": [
        {
          "names": [
            "linhlhq"
          ]
        }
      ],
      "cve": "CVE-2026-58014",
      "cwe": {
        "id": "CWE-193",
        "name": "Off-by-one Error"
      },
      "discovery_date": "2026-06-24T17:16:25.796000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492255"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\"",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Any applications loading or parsing untrusted key files, typically .desktop or .ini files, are vulnerable to this issue. This flaw can cause an off-by-one error, leading to an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58014"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492255",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492255"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58014",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58014"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58014",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58014"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3930",
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3930"
        }
      ],
      "release_date": "2026-04-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, implement input validation to sanitize untrusted key files (such as .desktop or .ini files), specifically rejecting or stripping empty values before calling g_key_file_get_locale_string_list(). Alternatively, restricting the application to only load key files from trusted sources will completely neutralize this issue.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\""
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Thepwnisher"
          ]
        }
      ],
      "cve": "CVE-2026-58015",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-06-24T17:22:00.405000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492256"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker must be in a position to perform a man-in-the-middle (MitM) attack on the connection or operate a malicious server that the client connects to. Furthermore, extracting data requires an oracle attack (guessing and hashing), increasing the complexity of exploitation. However, if successful, this issue allows the exfiltration of sensitive secrets, such as SSH keys or API tokens, from the filesystem. Due to these reasons, this vulnerability has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58015"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492256",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492256"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58015",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58015"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58015",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58015"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3931",
          "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3931"
        }
      ],
      "release_date": "2026-04-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, ensure that applications only connect to trusted D-Bus servers and operate within secure, isolated networks to prevent man-in-the-middle (MitM) attacks. If feasible, configuring the D-Bus connection to strictly require the EXTERNAL authentication mechanism and disabling DBUS_COOKIE_SHA1 will completely neutralize this issue.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive"
    },
    {
      "cve": "CVE-2026-59856",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-07-09T23:01:40.406872+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498867"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remote attacker to achieve arbitrary operating-system command execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this vulnerability as having a Moderate impact. While successful exploitation allows for arbitrary operating-system command execution when a user opens a crafted PHP file and triggers omni-completion, this feature is disabled by default in Red Hat products. The requirement for a non-default configuration, combined with mandatory user interaction, significantly reduces the real-world risk.\"",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498867",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498867"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59856",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59856",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24",
          "url": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97"
        }
      ],
      "release_date": "2026-07-09T22:39:01.803000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "Users should exercise caution when opening untrusted PHP files and avoid invoking omni-completion on them. To prevent exploitation, the PHP omni-completion script can be disabled by moving or renaming `phpcomplete.vim`. For example, execute `mv /usr/share/vim/vim*/autoload/phpcomplete.vim /usr/share/vim/vim*/autoload/phpcomplete.vim.bak`. This action will disable PHP omni-completion functionality. A restart of Vim is necessary for this change to take effect.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion"
    },
    {
      "cve": "CVE-2026-59858",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-07-09T23:01:43.278752+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498868"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A command injection vulnerability in Vim\u0027s C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Vim\u0027s C omni-completion script allows for arbitrary command execution. Exploitation requires a user to open a specially crafted C source file along with a malicious project tags file and then invoke C omni-completion. This limits the attack vector as it relies on specific user interaction and the presence of a hostile tags file, making it less likely to be exploited without user awareness.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498868",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498868"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e",
          "url": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x"
        }
      ],
      "release_date": "2026-07-09T22:37:52.789000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "Users are advised to avoid opening untrusted C source files or project tags files in Vim. Exercising caution and only processing trusted content prevents exploitation.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion"
    },
    {
      "cve": "CVE-2026-60002",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-07-08T01:01:33.808610+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2497936"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in OpenSSH client could allow a malicious SSH server to execute arbitrary code on the connecting client due to a use-after-free vulnerability during host key re-exchange. While requiring a connection to a specially crafted server, the potential for high impact on client confidentiality and integrity elevates the severity beyond Moderate.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-60002"
        },
        {
          "category": "external",
          "summary": "RHBZ#2497936",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497936"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-60002",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-60002"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-60002",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60002"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.4p1",
          "url": "https://www.openssh.org/releasenotes.html#10.4p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
          "url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
        }
      ],
      "release_date": "2026-07-08T00:17:33.058000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, OpenSSH clients should only connect to trusted SSH servers. Enforcing strict host key checking and carefully managing `known_hosts` files can help prevent connections to servers with unexpected or altered host keys, thereby reducing exposure to this client-side vulnerability.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side"
    },
    {
      "cve": "CVE-2026-64830",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-07-22T18:01:30.962327+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506193"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in FFmpeg, a widely used multimedia framework. This vulnerability, a heap buffer overflow in the VobSub subtitle demuxer, allows a remote attacker to corrupt memory. By providing a specially crafted subtitle file, an attacker can trigger unbounded writes, which could lead to arbitrary code execution in applications that use FFmpeg\u0027s VobSub demuxer. This could allow an attacker to take control of the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A heap buffer overflow in FFmpeg\u0027s VobSub subtitle demuxer can lead to arbitrary code execution when processing a specially crafted subtitle file. Exploitation requires user interaction, such as opening a malicious media file, which reduces the attack surface but can result in high impact if an affected application processes untrusted content.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-64830"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506193",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506193"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-64830",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64830"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64830",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64830"
        },
        {
          "category": "external",
          "summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951",
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951"
        },
        {
          "category": "external",
          "summary": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657",
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer",
          "url": "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"
        }
      ],
      "release_date": "2026-07-22T16:33:05.724000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid processing VobSub subtitle files from untrusted or unknown sources. For applications that utilize FFmpeg\u0027s VobSub demuxer, consider running them within a sandboxed environment to restrict the potential impact of a successful exploit.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer."
    },
    {
      "cve": "CVE-2026-73066",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-08-11T15:01:14.226581+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514011"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract\u0027s deserializer processes this component during OCR recognition, an unchecked integer multiplication can occur, leading to an undersized buffer and a heap out-of-bounds write. This vulnerability could result in a denial of service or potentially arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73066"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514011",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514011"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73066",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73066"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73066",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73066"
        },
        {
          "category": "external",
          "summary": "https://github.com/tesseract-ocr/tesseract/commit/2f4d2f4bf45c363785d7bf1da29b6628f8939a72",
          "url": "https://github.com/tesseract-ocr/tesseract/commit/2f4d2f4bf45c363785d7bf1da29b6628f8939a72"
        },
        {
          "category": "external",
          "summary": "https://github.com/tesseract-ocr/tesseract/pull/4588",
          "url": "https://github.com/tesseract-ocr/tesseract/pull/4588"
        },
        {
          "category": "external",
          "summary": "https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3",
          "url": "https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8",
          "url": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8"
        }
      ],
      "release_date": "2026-08-11T14:49:16.817000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid processing `.traineddata` files from untrusted sources with Tesseract. Ensure that only `.traineddata` files from known, reputable origins are used for OCR recognition.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata"
    },
    {
      "cve": "CVE-2026-73072",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-08-11T15:41:15.596551+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514037"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow in Vim allows a local attacker to cause a denial of service or potentially execute arbitrary code. The flaw is triggered by processing a specially crafted spell file, where the set_sofo() function fails to reset internal data between sections, leading to an out-of-bounds write.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Heap buffer overflow allows arbitrary code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A local attacker can exploit an Important heap buffer overflow in Vim to execute arbitrary code by tricking a user into loading a malicious spell file.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73072"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514037",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514037"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73072",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73072"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73072",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73072"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a",
          "url": "https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0846",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0846"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64"
        }
      ],
      "release_date": "2026-08-11T15:31:35.331000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "If spell checking is unused, disable it with set nospell in ~/.vimrc and do not set spelllang. If spell is required, load only trusted .spl files from Vim\u2019s spell directories and do not place untrusted spell files on runtimepath. Additionally, consider disabling modelines (set nomodeline in ~/.vimrc) to prevent untrusted text files from automatically overriding these settings when opened.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Heap buffer overflow allows arbitrary code execution"
    },
    {
      "cve": "CVE-2026-73076",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-08-11T15:41:02.894650+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514034"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimball#RmVimball() function.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary command execution via crafted vimball",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability in Vim where a crafted vimball can lead to arbitrary command execution. The flaw allows an attacker to embed malicious commands within a `.VimballRecord` file, which are then executed with user privileges during a later, unrelated vimball installation or removal. This extends the impact of processing untrusted vimball files beyond the initial installation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73076"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514034",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514034"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73076",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73076"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73076",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73076"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452",
          "url": "https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2"
        }
      ],
      "release_date": "2026-08-11T15:37:59.894000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "Avoid installing or removing vimballs from untrusted sources. This vulnerability relies on a user processing a malicious vimball, which then injects commands that are executed during a subsequent vimball operation. Exercise caution when handling vimball files from unknown or unverified origins.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary command execution via crafted vimball"
    },
    {
      "cve": "CVE-2026-73077",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-08-11T16:11:25.535913+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514065"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Vim\u0027s shell script plugins (sh.vim, zsh.vim, ps1.vim) allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Vim\u0027s shell plugins allows full system compromise in Red Hat environments if a user selects crafted text in Visual mode and triggers a keyword lookup. This does not affect RHEL 8 and older versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73077"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514065",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514065"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73077",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73077"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73077",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73077"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e",
          "url": "https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2"
        }
      ],
      "release_date": "2026-08-11T15:39:24.579000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, users can disable the `keywordprg` option for shell script filetypes. This prevents Vim from executing external commands via the `K` command with potentially untrusted input. Create or edit the following files in your Vim configuration directory:\n\n- `~/.vim/after/ftplugin/sh.vim`: `setlocal keywordprg=`\n- `~/.vim/after/ftplugin/zsh.vim`: `setlocal keywordprg=`\n- `~/.vim/after/ftplugin/ps1.vim`: `setlocal keywordprg=`\n\nThis change takes effect the next time a shell script is opened in Vim.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling"
    },
    {
      "cve": "CVE-2026-73078",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "discovery_date": "2026-08-11T16:10:59.827742+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514058"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in Vim\u0027s netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Vim\u0027s `netrw` plugin allows for arbitrary command execution in GUI Vim. By crafting a malicious directory path, an attacker could exploit improper neutralization of special characters when the path is browsed or bookmarked, leading to command injection. This issue specifically impacts GUI installations and requires user interaction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
          "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73078"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514058",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514058"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73078",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73078"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73078",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73078"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69",
          "url": "https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2"
        }
      ],
      "release_date": "2026-08-11T15:41:08.048000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-01T20:56:09+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:74683",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:74683"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid browsing or bookmarking untrusted or maliciously crafted directory paths within GUI Vim. Users should exercise caution when interacting with `netrw` menu entries derived from external or untrusted sources.",
          "product_ids": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:5a5e9c72bf9b952aee3a20a4fed1178668e6e30a54656d0ec2e4bf0e739b03d3_amd64",
            "Red Hat OpenShift AI 3.4:registry.redhat.io/rhai/base-image-cuda-13.0-rhel9@sha256:dfe507fda9e12073b3d4f6d4c2922773519d98489899ba45012913db5f73fbf4_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.